Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SCENARIO: Windows Server 2008, IIS 7, SQL Server 2005

I have a company website and i notice in the log this BOT (i think is a BOT) that continually hit some of my pages.

HTTP_USER_AGENT:http://www.checkprivacy.or.kr:6600/RS/PRIVACY_ENFAQ.jsp

Just a little note: This BOT look like come from Korea country and my server are in Europe.

In some case it create an error due calling a page without the correct parameters expected, ok i will fix the page to avoid the error.

What kind of approach i must have with this BOT ?

  1. Someone got experience with this BOT ?
  2. I must denied the access by setting a specific rule on the firewall?
  3. And in case that i need to block this BOT by the native firewall on Windows Server 2008, what is the best way to set this rule ? (I have basic knowledge about firewall, so i am not so expert)

Thanks in advance for your suggestion and tips.

p.s. let me know if is required more information

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Unless it's causing excessive load or actual issues, just ignore it. Public facing websites get hit by loads of bots, scanning software, idiots and every now and then some real users.

Monitor the logs using the right tools, keep your software up-to-date, and worry about more important things.

If you do get hit by a lot of traffic from one bot, if it is well behaved then look at robots.txt on the web, if it's not well behaved (i.e. ignores robots.txt) then you may have to block the IP address or IP address range assuming it always comes from the same place.

share|improve this answer
    
thanks for your answer, the site have a correct robots.txt, is well monitored, and it have thousand of real users daily because is a website of a big company with a e-commerce area. I notice the BOT hit hundred a day and it change the ip from some range as 110.45.148.xxx and 61.111.15.xxx so do you suggest to block those IP Ranges ? –  Luka Milani May 30 '12 at 20:08
    
I suggest you decide if the traffic is an issue and if it is you take action, if it's not, don't take action. 100 hits a day doesn't seem like a lot of traffic to worry about. –  EightBitTony May 30 '12 at 20:09
    
ok @EightBitTony, i follow your suggestion +1 and accept :) –  Luka Milani May 30 '12 at 20:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.